What about trust?
Who is selling me this card, and with my name, address and (optional) email address, how long will it take him to crack every one of my accounts, considering that he has the key?
A plastic card for easy to remember strong passwords
101–110 of 110 posts
Re: A plastic card for easy to remember strong passwords
#102It's rather ironic this site is all about strong security, when their SSL/TLS settings are terrible. (Including being open to the POODLE and OpenSSL CCS vulnerabilities) https://www.ssllabs.com/ssltest/analyze.html?d=qwertycards.c...
Thank you for bringing this to our attention - we’ve now upgraded the server to address this and will continue to monitor carefully for any other issues.
:)
Re: A plastic card for easy to remember strong passwords
#103Earlier quoted context omitted.
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized i…
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?) seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only l…
A normal Yubikey is still vulnerable to MITM and phishing attacks.
The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.
Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
Re: A plastic card for easy to remember strong passwords
#104Earlier quoted context omitted.
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was gen…
An attacker might setup a malicious site to collect passwords. They could also modify the server to record passwords when the user logs in.
You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.
Re: A plastic card for easy to remember strong passwords
#105I actually really like this idea. I guess if your attacker did get your password in the clear (bad encryption or whatever) then they'd basically have access everything right? I mean, the number of letters at the start is presumably fairly constant, they'd know the site it was for so they could then work out the "unique secret" in the middle right? That said, there's a certain amount of security through obscurity I gu…
why would anyone need to know your secret? Except that it would give them more characters in the substitution cypher. The card assumes a user will keep the same secret for each site, so just keep the start of the PW the same.
Re: A plastic card for easy to remember strong passwords
#106Earlier quoted context omitted.
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?) seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only l…
A normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key. Also, AFAIR, Yubikey…
You can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/
Re: A plastic card for easy to remember strong passwords
#107Earlier quoted context omitted.
A normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key. Also, AFAIR, Yubikey…
You can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/
Yes, but then it won't be supported by many sites that support Yubikey OTP and rely on Yubico's servers for authentication.
Re: A plastic card for easy to remember strong passwords
#108I did a web version: http://codepen.io/enjikaka/pen/zxNMQZ
EDIT: Just changed alot of things so if you viewed this in the last couple of minutes... take another look!
Re: A plastic card for easy to remember strong passwords
#109Earlier quoted context omitted.
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized i…
I'll go even a step further and say: passwords are a flawed solution They have been through history and way before the industrialized world, not only that but what was considered secure yesterday may be compromised today or tomorrow. This is not going away any time soon and you have to design security taking this into account. Another problem with password, it's that those web services we use password for collect way…
People keep saying that passwords are flawed, but what else is there? Authentication depends on secret information, does it not?
Re: A plastic card for easy to remember strong passwords
#110Brilliant! Until you lose your wallet. Much like lastpass and other password management software, you're putting all your eggs in one basket, and having faith it won't fail. Passwords are a shitty idea people. We need a better system.
People keep saying that passwords are a bad idea, but what else is there?